January 2022 - slf4j-dev - mailman3.qos.ch

[JIRA] Updates for SLF4J-540: Backward compatibility problem with 1.7.34 update
by QOS.CH (JIRA) 25 Jan '22

25 Jan '22

SLF4J / SLF4J-540 [Open] Backward compatibility problem with 1.7.34 update ============================== Here's what changed in this issue in the last few minutes. This issue has been created There is 1 comment. This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-540 ============================== Issue created ------------------------------ Archie Cobbs created this issue on 25/Jan/22 5:59 PM Summary: Backward compatibility problem with 1.7.34 update Issue Type: Bug Affects Versions: 1.7.34 Assignee: SLF4J developers list Components: Implementations Created: 25/Jan/22 5:59 PM Environment: MacOS 12.1 Apache Maven 3.8.4 (9b656c72d54e5bacbed989b64718c159fe39b537) Priority: Major Reporter: Archie Cobbs Severity: normal Description: I have a maven build for which logging during tests used to work. Snippets from pom.xml: {noformat} <properties> ... <slf4j.version>[1.7,1.8)</slf4j.version> ... </properties> ... <dependencies> <dependency> <groupId>org.slf4j</groupId> <artifactId>slf4j-api</artifactId> <version>${slf4j.version}</version> </dependency> <dependency> <groupId>org.slf4j</groupId> <artifactId>slf4j-log4j12</artifactId> <version>${slf4j.version}</version> <scope>test</scope> </dependency> ... <dependencies> {noformat} Dependency tree snippet: {noformat} [WARNING] The artifact org.slf4j:slf4j-log4j12:jar:1.7.34 has been relocated to org.slf4j:slf4j-reload4j:jar:1.7.34 ... [INFO] +- org.slf4j:slf4j-api:jar:1.8.0-beta4:compile [INFO] +- org.slf4j:slf4j-reload4j:jar:1.7.34:test [INFO] | \- ch.qos.reload4j:reload4j:jar:1.2.18.3:test {noformat} Nothing has changed in my configuration, but after the 1.7.34 release, logging during tests no longer works and instead I see this: {noformat} [INFO] ------------------------------------------------------- [INFO] T E S T S [INFO] ------------------------------------------------------- [INFO] Running TestSuite SLF4J: No SLF4J providers were found. SLF4J: Defaulting to no-operation (NOP) logger implementation SLF4J: See http://www.slf4j.org/codes.html#noProviders for further details. SLF4J: Class path contains SLF4J bindings targeting slf4j-api versions prior to 1.8. SLF4J: Ignoring binding found at [jar:file:/Users/archie/.m2/repository/org/slf4j/slf4j-reload4j/1.7.34/slf4j-reload4j-1.7.34.jar!/org/slf4j/impl/StaticLoggerBinder.class] SLF4J: See http://www.slf4j.org/codes.html#ignoredBindings for an explanation. {noformat} Is this backward-incompatibility expected? FYI I was able to workaround the issue with these changes: {noformat} - <slf4j.version>[1.7,1.8)</slf4j.version> + <slf4j.version>1.7.34</slf4j.version> ... - <artifactId>slf4j-log4j12</artifactId> + <artifactId>slf4j-reload4j</artifactId> {noformat} ============================== 1 comment ------------------------------ Ceki Gülcü on 25/Jan/22 6:01 PM Can you please try 1.7.35? ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-539: Gradle build fails with SLF4J 1.7.34
by QOS.CH (JIRA) 25 Jan '22

25 Jan '22

SLF4J / SLF4J-539 [Resolved] Gradle build fails with SLF4J 1.7.34 ============================== Here's what changed in this issue in the last few minutes. There is 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-539 ============================== 1 comment ------------------------------ Ceki Gülcü on 25/Jan/22 1:13 PM Yes, to both parts, although "where slf4j-log4j12 has been deployed" is too open ended for me to answer. {{slf4j-reload4j.jar}} replaces {{slf4j-log4j12.jar}} and {{reload4j.jar}} replaces {{log4j-1.2.17.jar}}. {quote} Am I correct with my assumption that 1.7.34/35 * replaces slf4j-log4j12 with slf4j-reload4j : *YES* * there are no more changes necessary [other] than replacing the slf4j-log4j12 JAR with the slf4j-reload4j JAR: *YES* {quote} ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-539: Gradle build fails with SLF4J 1.7.34
by QOS.CH (JIRA) 25 Jan '22

25 Jan '22

SLF4J / SLF4J-539 [Resolved] Gradle build fails with SLF4J 1.7.34 ============================== Here's what changed in this issue in the last few minutes. There is 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-539 ============================== 1 comment ------------------------------ Alexander Veit on 25/Jan/22 12:16 PM The error is gone with 1.7.35. Am I correct with my assumption that 1.7.34/35 * replaces slf4j-log4j12 with slf4j-reload4j and that * there are no more changes necessary than replacing the slf4j-log4j12 JAR with the slf4j-reload4j JAR where slf4j-log4j12 had been deployed? ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-539: Gradle build fails with SLF4J 1.7.34
by QOS.CH (JIRA) 25 Jan '22

25 Jan '22

SLF4J / SLF4J-539 [Resolved] Gradle build fails with SLF4J 1.7.34 ============================== Here's what changed in this issue in the last few minutes. There are 2 updates, 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-539 ============================== 2 updates ------------------------------ Changes by Ceki Gülcü on 25/Jan/22 11:51 AM Resolution: Fixed Status: Resolved (was: In Progress) ============================== 1 comment ------------------------------ Ceki Gülcü on 25/Jan/22 11:51 AM Can you please try 1.7.35? ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-539: Gradle build fails with SLF4J 1.7.34
by QOS.CH (JIRA) 25 Jan '22

25 Jan '22

SLF4J / SLF4J-539 [Open] Gradle build fails with SLF4J 1.7.34 ============================== Here's what changed in this issue in the last few minutes. There is 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-539 ============================== 1 comment ------------------------------ Ceki Gülcü on 25/Jan/22 11:31 AM Thank you for reporting this. ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-539: Gradle build fails with SLF4J 1.7.34
by QOS.CH (JIRA) 25 Jan '22

25 Jan '22

SLF4J / SLF4J-539 [Open] Gradle build fails with SLF4J 1.7.34 ============================== Here's what changed in this issue in the last few minutes. This issue has been created This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-539 ============================== Issue created ------------------------------ Alexander Veit created this issue on 25/Jan/22 11:05 AM Summary: Gradle build fails with SLF4J 1.7.34 Issue Type: Bug Affects Versions: 1.7.34 Assignee: SLF4J developers list Created: 25/Jan/22 11:05 AM Priority: Major Reporter: Alexander Veit Description: {noformat} > Task :copyLibraries FAILED FAILURE: Build failed with an exception. * What went wrong: Execution failed for task ':copyLibraries'. > Could not resolve all files for configuration ':api'. > Could not find org.slf4j:slf4j-reload4j:${project.version}. Required by: project : > org.slf4j:slf4j-log4j12:1.7.34 {noformat} {{build.gradle}} to reproduce the error: {noformat} plugins { id 'java-library' } repositories { mavenCentral() } configurations.api.setCanBeResolved(true) dependencies { api group: 'org.slf4j', name: 'slf4j-api', version: '1.7.+' api group: 'org.slf4j', name: 'slf4j-log4j12', version: '1.7.+' api group: 'org.slf4j', name: 'jcl-over-slf4j', version: '1.7.+' api group: 'org.slf4j', name: 'jul-to-slf4j', version: '1.7.+' } clean { delete "${rootDir}/lib" } task copyLibraries(type: Copy) { group = 'build' description = 'Copies libraries to the project\'s lib directory' from configurations.api + configurations.testCompileClasspath into 'lib' } {noformat} Command: {noformat} gradle clean copyLibraries --refresh-dependencies --warning-mode all {noformat} The new dependency org.slf4j:slf4j-reload4j that causes the problem is new for 1.7.34 and as far as I can tell from the SLF4J website we actually don't need it. ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

Release of SLF4J version 1.7.34
by Ceki Gülcü 25 Jan '22

25 Jan '22

Hello all, I am very happy to announce the immediate availability of SLF4J version 1.7.34. In this release, the "slf4j-log4j12" artifact automatically instructs Maven to use the "slf4j-reload4j" artifact instead. As you might have guessed, the "slf4j-reload4j" binding delegates log processing to the reload4j logging framework. The reload4j project is a fork of Apache log4j version 1.2.17 with the goal of fixing pressing security issues. It is intended as a drop-in replacement for log4j version 1.2.17. By drop-in, we mean the replacement of log4j.jar with reload4j.jar in your build with no source code changes in .java files being necessary. Reload4j project web site: https://reload4j.qos.ch/ If you are using slf4j-log4j12 as your binding of choice, please consider using slf4j-reload4j instead. In SLF4J version 1.7.34 and later, this redirection is seamless and automatic. Please refer to the the news page for more details on this release: http://www.slf4j.org/news.html The relevant artifacts should hit the Maven central repository within the next few hours. The 1.7.x series: The Simple Logging Facade for Java or (SLF4J) serves as a simple facade or abstraction for various logging frameworks, e.g. java.util.logging, reload4j and logback, allowing the end user to plug in the desired logging framework at deployment time. Binary compatibility: Mixing mixing different versions of slf4j-api.jar and SLF4J binding can cause problems. For example, if you are using slf4j-api-1.7.1.jar, then you should also use slf4j-simple-1.7.1.jar, using slf4j-simple-1.5.5.jar will not work. >From the client's perspective all versions of slf4j-api are compatible. Client code compiled with slf4j-api-N.jar will run perfectly fine with slf4j-api-M.jar for any N and M. You only need to ensure that the version of your binding matches that of the slf4j-api.jar. You do not have to worry about the version of slf4j-api.jar used to compile a given dependency in your project. You can always use *any* version of slf4j-api.jar, and as long as the version of slf4j-api.jar and its binding match, you should be fine. Downloading SLF4J: You can download SLF4J, including full source code, class files and documentation from Maven central under the "org.slf4j" groupId. Announcement mailing list: You can receive SLF4J related announcements by subscribing to the SLF4J announce mailing list. To subscribe to QOS.ch announce list, please visit the following URL. http://www.qos.ch/mailman/listinfo/announce Donations and sponsorship You can also support SLF4J/logback/reload4j projects via donations and sponsorship. We thank our current supporters and sponsors for their continued contributions. https://github.com/sponsors/qos-ch Enjoy, -- Ceki Gülcü Please contact support(at)qos.ch for donations, sponsorship or support contracts related to SLF4J/logback/reload4j projects.

1 0

slf4j 2.0.0-alpha6 still referring to log4j 1.x
by Vijayendhiran M 24 Jan '22

24 Jan '22

Hi Team, We are trying to upgrade slf4j to the latest version 2.0.0-alpha6 <https://mvnrepository.com/artifact/org.slf4j/slf4j-api/2.0.0-alpha6>. We have noticed that it is still referring to log4j 1.x. We need to upgrade log4j version 2.x in our application. Looking for your support. Thanks, Vijay.

4 7

[JIRA] Updates for SLF4J-538: There are high-risk vulnerabilities in Apache Log4j 1.x of SLF4J
by QOS.CH (JIRA) 22 Jan '22

22 Jan '22

SLF4J / SLF4J-538 [Open] There are high-risk vulnerabilities in Apache Log4j 1.x of SLF4J ============================== Here's what changed in this issue in the last few minutes. This issue has been created This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-538 ============================== Issue created ------------------------------ zhengqin created this issue on 22/Jan/22 3:01 AM Summary: There are high-risk vulnerabilities in Apache Log4j 1.x of SLF4J Issue Type: Bug Affects Versions: 1.7.30, 1.7.31, 1.7.32, 1.7.33 Assignee: SLF4J developers list Created: 22/Jan/22 3:01 AM Labels: vulnerabilities Priority: Critical Reporter: zhengqin Severity: critical Description: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23307] [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23305] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23302 ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-537: Release slf4j-jdk-platform-logging for 1.x
by QOS.CH (JIRA) 20 Jan '22

20 Jan '22

SLF4J / SLF4J-537 [Open] Release slf4j-jdk-platform-logging for 1.x ============================== Here's what changed in this issue in the last few minutes. There is 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-537 ============================== 1 comment ------------------------------ robin bygrave on 20/Jan/22 2:07 AM I have created a slf4j 1.x compatible platform logger at [https://github.com/avaje/slf4j-jdk-platform-logging] I am happy to donate this if desired. It is a refactor/modifications from the slf4j 2.x one. Cheers, Rob. ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0